7 ms·

NHS Covid-19 app update blocked for breaking Apple and Google's rules

49 points by mbalyuzi 5y ago

ourcat 5y ago
Many billions of pounds are being wasted on this. This failed app and system has had ten times the overall cost of the Mars Perseverance mission budgeted for it.
- Closi 5y ago
  Source? A quick google shows the app will cost c£35 million[1], while the overall cost of the Mars Perseverance programme is $2.7 billion[2]. 10 times $2.7 billion is $27 billion so you are out by a large factor. [1] https://www.digitalhealth.net/2020/09/total-cost-of-nhs-contact-tracing-app-set-to-top-35-million/ https://www.digitalhealth.net/2020/09/total-cost-of-nhs-cont... [2] https://www.planetary.org/articles/cost-of-perseverance-in-context https://www.planetary.org/articles/cost-of-perseverance-in-c...
  - adrianb 5y ago
    The entire Test & Trace costed about 37 billion (at the latest estimate) and ministers admitted it has only a marginal impact on limiting spread: https://blogs.bmj.com/bmj/2021/03/19/covid-19-test-and-trace-scandal-its-not-too-late-to-change-the-story/ https://blogs.bmj.com/bmj/2021/03/19/covid-19-test-and-trace...
    - Closi 5y ago
      This article is about the app though - which was £35 million. Why add in 36.9 billion of other costs? (other than to distort it to make it look much more expensive than it is?)
  - cameronh90 5y ago
    There's a lot of misleading information flying around about how much the app costs. The budget for the overall NHS Test and Trace system was £37bn last time I checked, and lots of news outlets seem to be trying to conflate that budget with either the cost of the tracing system (which didn't work very well) or the cost of the app. In reality, the vast majority of the spend has been on testing, and some of that budget likely remains unspent.
    - Closi 5y ago
      Agreed - framing it as "the app + system cost £37bn" would make you think that the app cost billions, rather than the app being approximately 1/10th of 1 percent of that figure.
cameronh90 5y ago
Irrespective of ones own feelings about this particular app: isn't it interesting that Google and Apple have the power to collect all our location data, but can refuse our democratic governments access to that data even on a voluntary basis?
- Hamuko 5y ago
  Apple and Google are just upholding their part of the agreement.
  - cameronh90 5y ago
    I'm not sure you can call it an agreement in any true sense. Apple and Google dictated the terms for accessing the Bluetooth hardware in the particular way required. Many governments around the world wanted more direct access to the hardware than Apple/Google have permitted, or (voluntary or otherwise) access to location data. Google and Apple said if you don't agree to these terms, you don't get to access anything. I'm not necessarily saying that's wrong or right. You could argue they're defending the user's rights against the tyranny of the British government. Or you could say they're constraining the user's and their democratically elected government's rights to voluntarily use data to help end a pandemic, while at the same time profiting off it themselves.
    - jjgreen 5y ago
      Governments do not have rights, they have power.
- mbalyuzi 5y ago
  I find it interesting that there seems to be a (wilful?) ignorance on the part of our government as to quite how big and powerful those corporations are. There seems to be a bit of a "We're the government, so they'll have to do what we ask/tell" going on here I suspect. Probably coupled with incompetent IT project management that didn't bother to worry about the terms and conditions they signed up to, because that was too hard.
bellyfullofbac 5y ago
Gotta love the images of the overly complex QR codes... Hey devs, stop packing so much info on those things!
- dgl 5y ago
  There's an analysis here: https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html Whole thing is a bit OTT.
- ditn 5y ago
  You might like this then - turns out the QR codes are a cluster https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html
  - rozab 5y ago
    Damn, you should make a new post for this article if it hasn't been posted yet
- deleted 5y ago
  [deleted]
- dkarp 5y ago
  I was curious what it was sending so scanned it: UKC19TRACING:1:eyJhbGciOiJFUzI1NiIsImtpZCI6ImlSNHdIVEIxdkF2a 2RjbEdCQWVwUlpxSzZSb29GbVNxcEpDQVd4alFvUFEifQ.eyJpZCI6IlA1Mkt XUFIzIiwidHlwIjoiZW50cnkiLCJvcG4iOiJFbncgTGxlb2xpYWQgeSBQcmF3 ZiIsImFkciI6IldlbHNoIEdvdmVybm1lbnRcbkNyb3duIEJ1aWxkaW5nXG5DY XRoYXlzIFBhcmtcbkNBUkRJRkYsIENGMTAgM05RIiwicHQiOiJDQVJESUZGIi wicGMiOiJDRjEwM05RIiwidnQiOiIwMDEifQ.3USKQlzdD4_RlH-wWvPPyQig 3tGbS8XUIFlTryqVzCmeWzc32YyKLjYpnzNOpUu0555-ym1kfvdDNAqnqyAWRw The first part "UKC19TRACING" obviously tells you it's for UK Covid 19 tracing. The second part "1" is maybe a version number. The rest is a json web token with the following payload: {"id":"P52KWPR3","typ":"entry","opn":"Enw Lleoliad y Prawf","adr":"Welsh Government\nCrown Building\nCathays Park\nCARDIFF, CF10 3NQ","pt":"CARDIFF","pc":"CF103NQ","vt":"001"} Honestly, this seems to me to be overly complicated but I don't really know how the apps work.
Gatsky 5y ago
If there is one thing we’ve learned from this pandemic it’s that apps will not save us.
- weddpros 5y ago
  If (western) governments had chosen to prevent the epidemic, apps would have helped, but they decided to let the virus spread, just slowly enough. Also (western) journalists love stories about 3M deaths, surveillance apps or fake news, much more than success stories. So yes, apps had no chance to save lives. Korea or Singapore show they could have, but we didn't let them.
  - mytailorisrich 5y ago
    China also shows that these apps (which combine track and trace, with status) are very useful to re-open the economy after lockdowns in a way that helps contain further outbreaks. Of course, saying "it seems to work in China" is the surest way to having a course of action shot down as unacceptable whatever its actual merits...
  - makomk 5y ago
    Part of the problem is that the mainstream media - including the BBC - seem to have mislead people about how well contact tracing worked in places like South Korea. For example, they ran an article a few months back about how it was so effective that South Korea could reopen their pubs and nightclubs. In reality, they'd tried doing that multiple times and every time, cases had started going up enough that they had to close them again - but you wouldn't know that from the article. Nor would you have known that the same thing happened that time; the BBC kept on completely ignoring the rise in cases there even as they reported less important stories from South Korea. Covid still isn't in control in South Korea. (Singapore maybe, but that relied on their society being structured in a way that wouldn't be politically acceptable elsewhere. If you take a look at the infection rate in their worker dorms, and realise those people would be living amongst the rest of the community in equally crowded housing and shopping at the same stores in Western countries - just like they were in Singapore until they were forced into dorms so actual citizens didn't have to look at them - and that those infections weren't even counted as "community cases" there...)
sitharus 5y ago
That's odd, since the NZ Covid Tracer app definitely has this feature, it's part of the standard process when someone tests positive. As far as I know it only includes the manually scanned codes though, not the bluetooth proximity tracing data. Perhaps the NHS app was trying to gather this?
- teruakohatu 5y ago
  > the terms and conditions in more detail says that "a contact tracing app may not use location-based APIs... and may not collect any device information to identify the precise location of users". I also wondered about this. The NZ app doesn't as far as I know log or transmit GPS coordinates. Some organisations have different codes at every door and in each elevator.
- woutr_be 5y ago
  It works the same in HK, once you test positive, you input your case number, and upload your check in history to some government servers. I assumed this is how every country does it.
- amanzi 5y ago
  Perhaps there's some details missing from the article, because it sounds just like how the NZ app operates. All data stays on your phone unless you choose to share it: "The information you choose to record with NZ COVID Tracer is stored on your phone where only you can see it. This includes the QR codes you scan, your manual diary entries, your Bluetooth ‘keys’, and your NHI number." If you're identified as a potential case, then you can choose whether or not you want to share your history: "If you are identified as a confirmed or probable case of COVID-19, it is entirely your choice whether to share your digital diary with the Ministry or upload your Bluetooth keys. You are in control of your data." More details here: https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-coronavirus/covid-19-resources-and-tools/nz-covid-tracer-app/privacy-and-security-nz-covid-tracer https://www.health.govt.nz/our-work/diseases-and-conditions/...
newbie578 5y ago
I won't go into the morality of this particular issue if Apple or Google is right or wrong in this case, but I do think that Apple and Google are slowly but surely pushing their limits... Even if they are right, no government wants to be beneath a corporation, and have it so publicly displayed how a corporation wields more power than government. Apple and Google are just asking to be regulated, and contrary to HN sentiment, I cannot wait for that moment. I think I'll open the champagne and make a toast to Tim Cook.
TYPE_FASTER 5y ago
The Exposure Notification FAQ: https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.2.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... Relevant quote from the FAQ doc: There will be restrictions on the data that apps can collect when using the API, including not being able to request access to location services, and restrictions on how data can be used.

49 points by mbalyuzi 5y ago

Many billions of pounds are being wasted on this. This failed app and system has had ten times the overall cost of the Mars Perseverance mission budgeted for it.

Closi 5y ago
Source? A quick google shows the app will cost c£35 million[1], while the overall cost of the Mars Perseverance programme is $2.7 billion[2]. 10 times $2.7 billion is $27 billion so you are out by a large factor. [1] https://www.digitalhealth.net/2020/09/total-cost-of-nhs-contact-tracing-app-set-to-top-35-million/ https://www.digitalhealth.net/2020/09/total-cost-of-nhs-cont... [2] https://www.planetary.org/articles/cost-of-perseverance-in-context https://www.planetary.org/articles/cost-of-perseverance-in-c...
- adrianb 5y ago
  The entire Test & Trace costed about 37 billion (at the latest estimate) and ministers admitted it has only a marginal impact on limiting spread: https://blogs.bmj.com/bmj/2021/03/19/covid-19-test-and-trace-scandal-its-not-too-late-to-change-the-story/ https://blogs.bmj.com/bmj/2021/03/19/covid-19-test-and-trace...
  - Closi 5y ago
    This article is about the app though - which was £35 million. Why add in 36.9 billion of other costs? (other than to distort it to make it look much more expensive than it is?)
- cameronh90 5y ago
  There's a lot of misleading information flying around about how much the app costs. The budget for the overall NHS Test and Trace system was £37bn last time I checked, and lots of news outlets seem to be trying to conflate that budget with either the cost of the tracing system (which didn't work very well) or the cost of the app. In reality, the vast majority of the spend has been on testing, and some of that budget likely remains unspent.
  - Closi 5y ago
    Agreed - framing it as "the app + system cost £37bn" would make you think that the app cost billions, rather than the app being approximately 1/10th of 1 percent of that figure.

cameronh90 5y ago

Irrespective of ones own feelings about this particular app: isn't it interesting that Google and Apple have the power to collect all our location data, but can refuse our democratic governments access to that data even on a voluntary basis?

Hamuko 5y ago
Apple and Google are just upholding their part of the agreement.
- cameronh90 5y ago
  I'm not sure you can call it an agreement in any true sense. Apple and Google dictated the terms for accessing the Bluetooth hardware in the particular way required. Many governments around the world wanted more direct access to the hardware than Apple/Google have permitted, or (voluntary or otherwise) access to location data. Google and Apple said if you don't agree to these terms, you don't get to access anything. I'm not necessarily saying that's wrong or right. You could argue they're defending the user's rights against the tyranny of the British government. Or you could say they're constraining the user's and their democratically elected government's rights to voluntarily use data to help end a pandemic, while at the same time profiting off it themselves.
  - jjgreen 5y ago
    Governments do not have rights, they have power.
mbalyuzi 5y ago
I find it interesting that there seems to be a (wilful?) ignorance on the part of our government as to quite how big and powerful those corporations are. There seems to be a bit of a "We're the government, so they'll have to do what we ask/tell" going on here I suspect. Probably coupled with incompetent IT project management that didn't bother to worry about the terms and conditions they signed up to, because that was too hard.

bellyfullofbac 5y ago

Gotta love the images of the overly complex QR codes... Hey devs, stop packing so much info on those things!

dgl 5y ago
There's an analysis here: https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html Whole thing is a bit OTT.
ditn 5y ago
You might like this then - turns out the QR codes are a cluster https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html https://www.revk.uk/2020/09/how-not-to-qr-nhs-c19-app.html
- rozab 5y ago
  Damn, you should make a new post for this article if it hasn't been posted yet
deleted 5y ago
[deleted]
dkarp 5y ago
I was curious what it was sending so scanned it: UKC19TRACING:1:eyJhbGciOiJFUzI1NiIsImtpZCI6ImlSNHdIVEIxdkF2a 2RjbEdCQWVwUlpxSzZSb29GbVNxcEpDQVd4alFvUFEifQ.eyJpZCI6IlA1Mkt XUFIzIiwidHlwIjoiZW50cnkiLCJvcG4iOiJFbncgTGxlb2xpYWQgeSBQcmF3 ZiIsImFkciI6IldlbHNoIEdvdmVybm1lbnRcbkNyb3duIEJ1aWxkaW5nXG5DY XRoYXlzIFBhcmtcbkNBUkRJRkYsIENGMTAgM05RIiwicHQiOiJDQVJESUZGIi wicGMiOiJDRjEwM05RIiwidnQiOiIwMDEifQ.3USKQlzdD4_RlH-wWvPPyQig 3tGbS8XUIFlTryqVzCmeWzc32YyKLjYpnzNOpUu0555-ym1kfvdDNAqnqyAWRw The first part "UKC19TRACING" obviously tells you it's for UK Covid 19 tracing. The second part "1" is maybe a version number. The rest is a json web token with the following payload: {"id":"P52KWPR3","typ":"entry","opn":"Enw Lleoliad y Prawf","adr":"Welsh Government\nCrown Building\nCathays Park\nCARDIFF, CF10 3NQ","pt":"CARDIFF","pc":"CF103NQ","vt":"001"} Honestly, this seems to me to be overly complicated but I don't really know how the apps work.

Gatsky 5y ago

If there is one thing we’ve learned from this pandemic it’s that apps will not save us.

weddpros 5y ago
If (western) governments had chosen to prevent the epidemic, apps would have helped, but they decided to let the virus spread, just slowly enough. Also (western) journalists love stories about 3M deaths, surveillance apps or fake news, much more than success stories. So yes, apps had no chance to save lives. Korea or Singapore show they could have, but we didn't let them.
- mytailorisrich 5y ago
  China also shows that these apps (which combine track and trace, with status) are very useful to re-open the economy after lockdowns in a way that helps contain further outbreaks. Of course, saying "it seems to work in China" is the surest way to having a course of action shot down as unacceptable whatever its actual merits...
- makomk 5y ago
  Part of the problem is that the mainstream media - including the BBC - seem to have mislead people about how well contact tracing worked in places like South Korea. For example, they ran an article a few months back about how it was so effective that South Korea could reopen their pubs and nightclubs. In reality, they'd tried doing that multiple times and every time, cases had started going up enough that they had to close them again - but you wouldn't know that from the article. Nor would you have known that the same thing happened that time; the BBC kept on completely ignoring the rise in cases there even as they reported less important stories from South Korea. Covid still isn't in control in South Korea. (Singapore maybe, but that relied on their society being structured in a way that wouldn't be politically acceptable elsewhere. If you take a look at the infection rate in their worker dorms, and realise those people would be living amongst the rest of the community in equally crowded housing and shopping at the same stores in Western countries - just like they were in Singapore until they were forced into dorms so actual citizens didn't have to look at them - and that those infections weren't even counted as "community cases" there...)

sitharus 5y ago

That's odd, since the NZ Covid Tracer app definitely has this feature, it's part of the standard process when someone tests positive. As far as I know it only includes the manually scanned codes though, not the bluetooth proximity tracing data. Perhaps the NHS app was trying to gather this?

teruakohatu 5y ago
> the terms and conditions in more detail says that "a contact tracing app may not use location-based APIs... and may not collect any device information to identify the precise location of users". I also wondered about this. The NZ app doesn't as far as I know log or transmit GPS coordinates. Some organisations have different codes at every door and in each elevator.
woutr_be 5y ago
It works the same in HK, once you test positive, you input your case number, and upload your check in history to some government servers. I assumed this is how every country does it.
amanzi 5y ago
Perhaps there's some details missing from the article, because it sounds just like how the NZ app operates. All data stays on your phone unless you choose to share it: "The information you choose to record with NZ COVID Tracer is stored on your phone where only you can see it. This includes the QR codes you scan, your manual diary entries, your Bluetooth ‘keys’, and your NHI number." If you're identified as a potential case, then you can choose whether or not you want to share your history: "If you are identified as a confirmed or probable case of COVID-19, it is entirely your choice whether to share your digital diary with the Ministry or upload your Bluetooth keys. You are in control of your data." More details here: https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-coronavirus/covid-19-resources-and-tools/nz-covid-tracer-app/privacy-and-security-nz-covid-tracer https://www.health.govt.nz/our-work/diseases-and-conditions/...

newbie578 5y ago

I won't go into the morality of this particular issue if Apple or Google is right or wrong in this case, but I do think that Apple and Google are slowly but surely pushing their limits... Even if they are right, no government wants to be beneath a corporation, and have it so publicly displayed how a corporation wields more power than government. Apple and Google are just asking to be regulated, and contrary to HN sentiment, I cannot wait for that moment. I think I'll open the champagne and make a toast to Tim Cook.

TYPE_FASTER 5y ago

The Exposure Notification FAQ: https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.2.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... Relevant quote from the FAQ doc: There will be restrictions on the data that apps can collect when using the API, including not being able to request access to location services, and restrictions on how data can be used.